Software Seminar Series (S3)

Tuesday, May 22, 2018

12:00pm Meeting room 302 (Mountain View), level 3

Pepe Vila, PhD Student, IMDEA Software Institute

Theory and Practice of Finding Eviction Sets

Abstract:

Many micro-architectural attacks rely on the capability of an
attacker to efficiently find small eviction sets: groups of virtual
addresses that map to the same cache set. This capability has become a
decisive primitive for cache sidechannel, rowhammer, and speculative
execution attacks. Despite their importance, algorithms for finding
small eviction sets have not been systematically studied in the literature.
In this talk, we perform such a systematic study. We begin by
formalizing the problem and analyzing the probability that a set of
random virtual addresses is evicting. We then present novel algorithms,
based on ideas from threshold group testing, that reduce random eviction
sets to their minimal core in linear time, improving over the quadratic
state-of-the-art.
We complement the theoretical analysis of our algorithms with a rigorous
empirical evaluation in which we identify and isolate factors that
affect their reliability in practice, such as adaptive replacement
strategies and TLB thrashing. Our results indicate that our algorithms
enable finding small eviction sets much faster than before, and under
conditions where this was previously deemed impractical.